JP2018513500A - System and method for handling events involving computing systems and networks using a fabric monitoring system - Google Patents

Abstract

The method includes receiving (702) information identifying an occurrence of an event in an enterprise system having a plurality of computing or networking systems (102a-102n) at the fabric monitoring system (110). The event occurs or participates in a computing or networking device (104, 106) within the computing or networking system, and the event is identified using rules accessible by the fabric monitoring system. The method further includes the steps (704, 708) of processing the information in real time to identify the occurrence of the event and assigning the event to multiple situations using a fabric monitoring system. Events are assigned to the above situation using one or more processing models accessible by the fabric monitoring system. The method further includes outputting (710) information identifying the situation.

Description

  The present disclosure relates generally to computing systems. More particularly, this disclosure relates to systems and methods for handling events involving computing systems and networks using a fabric monitoring system.

  Businesses, governments, and other organizations often have a large number of computing and networking devices distributed over a wide geographic area. For example, a large multinational company has multiple data centers, each with tens of thousands of computing and networking devices, and various offices around the world ranging from a small number of computing or networking devices to thousands of computing or networking devices. And may have. Each computing or networking device represents a source of possible abnormalities or other events that need to be tracked, investigated, and resolved as needed. However, handling the events can consume more and more time and resources of the organization as the size of the organization grows with its computing systems and networks.

  The present disclosure provides systems and methods for handling events involving computing systems and networks using a fabric monitoring system.

  In a first embodiment, a method includes receiving information identifying an occurrence of an event in an enterprise system having a plurality of computing or networking systems in a fabric monitoring system. An event occurs or participates in a computing or networking device within a computing or networking system, and the event is identified using rules accessible by the fabric monitoring system. The method further includes using the fabric monitoring system to process the information in real time to identify the occurrence of the event and assign the event to multiple situations. Events are assigned to situations using one or more processing models accessible by the fabric monitoring system. The method further includes outputting information identifying the situation.

  In a second embodiment, a system includes a fabric monitoring system having a plurality of computing nodes and a plurality of communication links that couple the computing nodes. The fabric monitoring system is configured to receive information identifying the occurrence of an event in an enterprise system having a plurality of computing or networking systems. An event occurs or participates in a computing or networking device within a computing or networking system, and the event is identified using rules accessible by the fabric monitoring system. The fabric monitoring system is further configured to process the information in real time to identify the occurrence of the event and assign the event to multiple situations. Events are assigned to situations using one or more processing models accessible by the fabric monitoring system. The fabric monitoring system is further configured to output information identifying the situation.

  In a third embodiment, a non-transitory computer readable medium includes computer readable program code, the computer readable program code being stored on a computing node when executed by a computing node of a fabric monitoring system. And receiving information identifying the occurrence of an event in an enterprise system having a computing or networking system. An event occurs or participates in a computing or networking device within a computing or networking system, and the event is identified using rules accessible by the fabric monitoring system. The computer readable program code, when executed by a computing node of the fabric monitoring system, causes the computing node to process the information in real time to identify the occurrence of the event and assign the event to multiple situations. Let me further. Events are assigned to situations using one or more processing models accessible by the fabric monitoring system. The computer readable program code further causes the computing node to output information identifying the situation when executed by the computing node of the fabric monitoring system.

  Other technical features will be readily apparent to one skilled in the art from the following figures, descriptions, and claims.

For a more complete understanding of the present disclosure and its features, reference is now made to the following description, taken in conjunction with the accompanying drawings.
1 illustrates an exemplary system for handling events involving a computing system and a network using a fabric monitoring system according to the present disclosure. 1 illustrates an example computing device associated with a system that handles events involving a computing system and a network using a fabric monitoring system according to the present disclosure; 1 illustrates an example fabric monitoring system and related details for handling events involving computing systems and networks according to the present disclosure. 1 illustrates an example fabric monitoring system and related details for handling events involving computing systems and networks according to the present disclosure. 1 illustrates an example fabric monitoring system and related details for handling events involving computing systems and networks according to the present disclosure. 1 illustrates an example fabric monitoring system and related details for handling events involving computing systems and networks according to the present disclosure. 2 illustrates an exemplary process flow in a system that handles events involving a computing system and a network using a fabric monitoring system in accordance with the present disclosure. 2 illustrates an exemplary process flow in a system that handles events involving a computing system and a network using a fabric monitoring system in accordance with the present disclosure.

  The various embodiments used to explain the principles of the present invention in FIGS. 1-8, discussed below, and in this patent document, are merely exemplary and are considered to limit the scope of the invention in any way. Should not. Those skilled in the art will appreciate that the principles of the present invention may be implemented in any type of suitably arranged device or system.

  FIG. 1 illustrates an example system 100 that handles involving events in computing systems and networks using a fabric monitoring system according to the present disclosure. As shown in FIG. 1, system 100 includes or is associated with one or more computing systems or networks 102a-102n. Each computing system or network 102a-102n represents a collection of computing devices 104 and / or networking devices 106. Each computing system or network 102a-102n may include any number of devices 104 and / or 106. As described above, a computing system or network 102a-102n can have up to tens of thousands of devices 104 and / or 106 (or more) from a system or network having only a handful of devices 104 and / or 106. It may span any system or network it has. Multiple computing systems or networks 102a-102n can be used within a single common geographic area or across multiple geographic areas including areas separated by a significant distance.

  One or more devices in each of the computing systems or networks 102a-102n may communicate over at least one network 108. Network 108 represents any suitable network or combination of networks at one or more locations. The network 108 may include, for example, one or more local area networks (LANs), wide area networks (WANs), metropolitan area networks (MANs), or regional or global networks. A collection of computing systems or networks 102a-102n and associated network 108 may be referred to in this patent document as an “enterprise system”.

  The fabric monitoring system 110 is implemented in an enterprise system, such as by using a variety of computing devices 104 and networking devices 106 in a computing system or network 102a-102n. Fabric computing (also referred to as unified computing, unified fabric, data center fabric, unified data center fabric) is the computing formed by computing nodes 112 interconnected using communication links 114. Involved in creating the fabric. The exact layout of the computing nodes 112 and network connectivity topology defined by the communication link 114 may vary from what is shown here as needed or desired. The fabric monitoring system 110 is a merged high performance including loosely coupled storage, networking, and parallel processing functions linked by high bandwidth interconnects (such as 10 Gigabit Ethernet, InfiniBand connections, etc.). Routinely includes a computing system. In some embodiments, the interconnected nodes appear to execute as a single logical unit.

  The basic components of the fabric monitoring system 110 are its node 112 and its link 114. Node 112 typically includes hardware components such as processors, memory, and peripheral devices. Link 114 is a functional connection between nodes 112. The fabric monitoring system 110 can be distinguished from other architectures for several reasons. For example, the fabric monitoring system 110 can be deployed in multiple “stripes” to provide cross-stripe communication and signaling support. This provides improved scalability and resiliency for the fabric monitoring system 110. Further, the fabric monitoring system 110 can support multiple types of processing models (such as user-defined models and analytical models), which are associated with the computing system or networks 102a-102n. Supports multiple mechanisms for identifying and classifying events.

  As described in more detail below, the fabric monitoring system 110 monitors, diagnoses, and monitors enterprise applications deployed in computing systems or networks 102a-102n and other aspects of the computing systems or networks 102a-102n. And can be advantageously used in maintaining. An enterprise application represents an application that is deployed on multiple devices 104 and / or 106 at one or more locations and that provides event-related information to the fabric monitoring system 110. Traditional monitoring systems often provide alerts for individual anomalies or system failures, but these monitoring systems typically provide an integrated approach to correctly categorize and handle system and application events across large enterprise systems Failed to do. The fabric monitoring system 110 can provide an integrated approach for correctly categorizing and handling system and application events used in various environments including large enterprise systems.

  Among other things, this allows the fabric monitoring system 110 to provide organization level diagnosis and maintenance. For example, the fabric monitoring system 110 may provide a complete situation management lifecycle of events from the occurrence or initiation of the event to its (possibly automated) resolution, as described below. Can be used. The fabric monitoring system 110 may further provide event processing based on analysis and machine learning instead of or in addition to static rules. Furthermore, the fabric monitoring system 110 can provide a highly scalable platform for infrastructure and application metrics collection with rapid incident resolution based on predictive analysis. This can allow the fabric monitoring system 110 to be used for more predictive functions related to event processing rather than simply reacting to events that have occurred.

  Events identified and processed by the fabric monitoring system 110 represent bits of information and may originate from any suitable source within the computing system or networks 102a-102n. For example, an event can represent a current state or a change in the current state of a device, system, or network (or part thereof). Events can further be used to identify the occurrence of anomalies or defined conditions within a computing system or network 102a-102n. Examples of specific types of events include current central processing unit (CPU) utilization of the computer executing the application, identification of a fault on the computer executing the application, or a faulty connection identified by the application. it can. As described below, the rules used by the fabric monitoring system 110 help to identify events of interest in real time, which can then be investigated (manually or in an automated manner) Used to identify the situation being resolved.

  The situation is derived from a stream of events and can be identified using various processing models, which define how the fabric monitoring system 110 processes the event and identifies the situation. For example, the processing model can indicate that a situation should be created for each event. As another example, a processing model indicates that a situation should be created when a specified number or type of events associated with a single asset or group of assets occur within a defined time period be able to. An asset therefore generally represents some hardware, software, firmware, or combination. Examples of assets can include specific hardware (such as switches or host computers), specific applications, or other virtual / physical computing platforms. A library of processing models and baseline policies can be created and stored within the fabric monitoring system 110, and these models and policies may be directly applicable to infrastructure or application event monitoring domains.

  Each identified situation can be translated and communicated across the system for further action. For example, the situation can be given a ticket number and routed to a system maintenance or operational intelligence platform for corrective action, or the situation can be identified as relating to automated reporting and correction functions within the enterprise application. May be.

  Thus, the entire enterprise system can be monitored and maintained with reports and records at a specific event level using the fabric monitoring system 110. Event processing including categorization, reporting, and correction and / or prediction actions can be based on analysis and machine learning techniques instead of or in addition to static rules and filters. As such, event monitoring utilizing fabric monitoring system 110 across enterprise systems presents a highly scalable and unified platform for infrastructure and application metrics collection and provides rapid incident resolution based on predictive analysis To do.

  The fabric monitoring system 110 can further operate to help ensure that event depletion is mitigated. Event depletion may generate an excessive number of events, such as due to faulty applications or devices, or due to intentional denial of service (DOS) attacks, distributed DOS (DDOS) attacks, or other attacks. May occur. An excessive number of events can overload a conventional system and cause the system to stop providing events to downstream components (thus downstream components “starved” events). . In some embodiments, the fabric monitoring system 110 addresses issues related to event exhaustion by enabling component abstraction.

  The fabric monitoring system 110 may further provide messaging and persistence and use of reference data during event routing, situation detection, and event enrichment. For example, in some embodiments, as each event is processed through the fabric monitoring system 110, a detailed history of the processing of each event can be stored in persistent storage. The event history can be queried and searched, such as by using a query or search function.

  Further, the protocol and functionality related to event subscription allows the fabric monitoring system 110 to support preemptive awareness of events and situations in the enterprise system and enterprise applications within the enterprise system, Often depends on the underlying low-level infrastructure components. For example, the fabric monitoring system 110 can support event subscription so that situations derived from events occurring in separate or different areas of an organization's infrastructure can be created.

  In some embodiments, the user can configure policies and rules that are used to specify how events are categorized and escalated. Two exemplary mechanisms for configuring an event management policy include: (i) a predefined selection of standardized specifications, and (ii) a domain specific language (DSL) that describes specialized specifications. It is. DSL can, for example, allow events to be given the same name or other identifier or sent to a grouping model, which can be selected based on a schedule or behavior analysis.

  The fabric monitoring system 110 further supports various processing models for event grouping and situation identification. Two exemplary types of models include user-defined grouping models and discovered or analytical grouping models. Multiple processing models may be used or supported, and additional processing models may be created as needed or desired to define different grouping patterns. User-defined grouping models are defined by one or more users, examples of user-defined grouping models include “One for One”, “X over Y”, And “battery failure”. An analysis model is defined as a model that supports one or more analysis functions, and examples of analysis models include grouping by event similarity, or grouping by event anomalies (uncategorized events, new or viewed Events, event volume irregularities, lack of expected events, unregistered events, etc.).

  In some embodiments, event categorization may be stateless and distributed, however, many nodes 112 are required or available to handle the load. A messaging system within the fabric monitoring system 110 can be used to distribute events to available processing nodes 112. The messaging system may implement or utilize a “group key” or other indicator to ensure that any event that is part of the same group is delivered to the same processing node 112. Groups can be defined in any suitable manner, such as by grouping events associated with a single asset or collection of assets. The messaging system and the specific persistence mechanism may also be “pluggable”, which means a lower cost implementation of various mechanisms for quality assurance and development of additional functionality within the fabric system. make it easier. The state required for model evaluation can be cached in the processing instance, the messaging system can deliver events to the node 112 or where information is cached, and continuity can be This can be achieved, for example, by drop copy of changes.

  As described above, the fabric monitoring system 110 can include built-in support for striped processing flows, which enables platform isolation and reduces the risks associated with event depletion. May help. Using striping, different nodes 112 or even different instances of the fabric monitoring system 110 themselves handle events from different sources, such as events from different assets, different regions, or different hardware / software / firmware deployments. Can be used to do. Other partitions that support striping can be further used, such as by dividing the enterprise system by business units that are traded using computing systems or networks 102a-102n or by business type. One challenge in striping involves how to communicate events or situations in one stripe to other stripes that need to know such events or situations. In some embodiments, this can be done by creating a composite event for the creation of situations within a stripe. These composite events can then be distributed to other stripes to enable cross-stripe correlations of events or situations.

  Depending on the implementation, the fabric monitoring system 110 provides intelligent monitoring and notification of situations requiring action, including notification to system administrators, user groups, or subscribers. Further, the situation can be a single event on the enterprise system or multiple events that are correlated to provide deep insight into anomalies within the enterprise system. In addition, the fabric monitoring system 110 can reduce operational and regulatory risks by delivering transparency and intelligent management of large-scale enterprise technology environment events. The fabric monitoring system 110 further distributes the workflow for the user and how events are categorized, reported, and recorded (such as by priority, group, status, or user-defined category). And how subsequent actions are assigned and executed. The fabric monitoring system 110 further allows the event grouping policy to be exposed to a controlled inspection and promotion life cycle, which allows exposure related to unwanted changes or unnecessary processing in the production environment. Reduced. In addition, the fabric monitoring system 110 provides a controlled lifecycle for policies and rules due to the separation of users who can create rules and users who can facilitate the rules for production or use. Can support forcing.

  Further details regarding the fabric monitoring system 110 are provided below. Note that the fabric monitoring system 110 may include any number of nodes 112 and communication links 114 in any suitable arrangement. Although the fabric monitoring system 110 is illustrated as being external to the computing system or networks 102a-102n, the fabric monitoring system 110 may be formed or exist within one or more of the computing systems or networks 102a-102n. Good.

  Although FIG. 1 illustrates an example of a system 100 that handles events involving computing systems and networks using the fabric monitoring system 110, various changes may be made to FIG. For example, the system 100 can include any number of computing systems or networks (each having any number of computing or networking devices), networks, and fabric monitoring systems. Further, the systems and networks involved in the computer are highly configurable, and FIG. 1 does not limit the present disclosure to any particular configuration of systems or networks.

  FIG. 2 illustrates an exemplary computing device 200 associated with a system that handles events involving a computing system and a network using a fabric monitoring system according to the present disclosure. Specifically, FIG. 2 illustrates an exemplary implementation of the computing node 112 within the fabric monitoring system 110 of FIG.

  As shown in FIG. 2, computing device 200 includes a bus system 202, which includes at least one processing device 204, at least one storage device 206, at least one communication unit 208, and at least one input / Communication with the output (I / O) unit 210 is supported. The processing unit 204 executes instructions that may be loaded into the memory 212. The processing unit 204 can include any suitable number and type of processors or other devices in any suitable arrangement. Exemplary types of processing devices 204 include microprocessors, microcontrollers, digital signal processors, field programmable gate arrays, application specific integrated circuits, and discrete circuits.

  Memory 212 and persistent storage 214 are examples of storage device 206, which stores information (such as data, program code, and / or other suitable information in a temporary or permanent manner). And any structure that can facilitate the retrieval of information. Memory 212 may represent random access memory or any other suitable volatile or non-volatile storage device. Persistent storage device 214 may include one or more components or devices that support longer term data storage, such as read only memory, hard drive, flash memory, or optical disk.

  The communication unit 208 supports communication with other systems or devices. For example, the communication unit 208 can include a network interface card or wireless transceiver that facilitates communication with other nodes 112 over one or more communication links 114. The communication unit 208 can support communication through any suitable physical or wireless communication link.

  The I / O unit 210 allows data input and output. For example, the I / O unit 210 can provide a connection for input and output of data to a local external memory, database, or peripheral device.

  Although FIG. 2 illustrates an example of a computing device 200 associated with a system that handles events involving a computing system and a network using a fabric monitoring system, various changes may be made to FIG. For example, the computing device is highly configurable, and FIG. 2 does not limit the present disclosure to any particular configuration of computing device.

  FIGS. 3-6 illustrate an example fabric monitoring system 110 and associated details for handling events involving computing systems and networks according to this disclosure. As shown in FIG. 3, the fabric monitoring system 110 is operating in conjunction with a host 302, which can represent any of the computing devices 104 or networking devices 106 in FIG. . Here, the host 302 includes various hardware components, such as one or more processors 304, one or more hard disks 306, and one or more memories 308. The processor 304 (among others) can be used to execute one or more enterprise applications or other applications. Of course, the host device can occur in a wide variety of configurations, which may include other or additional hardware components. Note that although one host 302 is shown in FIG. 3, the fabric monitoring system 110 can be used with any number of hosts or other sources of events.

  Host 302 includes an event agent 310 and an event application programming interface (API) 312. The event agent 310 collects events generated by the host 302 and provides the events to the fabric monitoring system 110 via the event API 312. Event agent 310 includes any suitable logic for collecting events, and event API 312 includes any suitable interface that interfaces with event agent 310. The event agent 310 can represent, for example, one or more applications that are executed by the processor 304.

  The fabric monitoring system 110 includes a monitoring platform 314 that operates to collect events from the host 302 and other event sources. Among other things, detected events can identify aspects of a computing or networking environment that are not running as expected or that meet user-defined or other monitoring rules. In this example, the monitoring platform 314 includes an event server 312 and a telemetry module 316. Event server 314 collects events from event agent 310 in host 302 and from other event agents in other hosts or event sources. Telemetry module 316 analyzes detected events or other information and provides metrics for troubleshooting, capacity planning, or other functions. Information from telemetry module 316 can contribute at least in part to prevention of event depletion, for example. Event server 314 includes any suitable logic for collecting events from event agents. In some embodiments, event agent 310 and event server 314 may represent information technology (IT) monitoring tools, such as those available from NAGIOS ENTERPRISES. Telemetry module 316 includes any suitable logic that identifies one or more metrics associated with an incoming event.

  The fabric monitoring system 110 further includes a core platform 320 that analyzes the events obtained by the monitoring platform 314 and has occurred in one or more of the computing systems or networks 102a-102n. Or identify possible situations. In this example, the core platform 320 supports a correlation function 322 that can be used to identify events that are related and therefore can form part of one or more situations. The core platform 320 further supports an aggregation function 324, which can be used to group related events for further processing. The core platform 320 further supports an enhancement function 326, which can be used to provide further information regarding the event or group of events. The information provided by the enhancement function 326 can be used by the aggregation function 324 to group related events in some examples. The core platform 320 further supports suppression functions 328, which can be used to suppress certain events, and therefore these events are not used to create a situation (eg, uninteresting About known events). Further, the core platform 320 supports one or more autonomous services 330, which can represent services that occur automatically in response to changing conditions. For example, the autonomous service 330 provides a self-healing, self-configuring, self-optimizing, or self-protecting function that modifies the fabric monitoring system 110 or computing system or network 102a-102n in response to detected conditions. Can be supported.

  Although not shown, the fabric monitoring system 110 or the core platform 320 can support other functions. For example, one or more analysis functions can be used to analyze the event to estimate the health of the application and its dependencies within the computing system or network 102a-102n. As another example, one or more reporting functions can be used to provide a historical view of events, agent health, and data collected by the system. In this example, reports or other information can be provided to various destinations 332a-332c. In this example, the destination is an alert console 332a representing a device configured to present alerts or other information to the user, a dependency graph representing a graphical display representing device dependencies in a computing system or network. 332b, a pulse indicator 332c that presents an indication of the number of detected events or situations is included. Of course, information from the fabric monitoring system 110 may be presented to any other or further destination or used in any other suitable manner.

  In this example, the policy manager 334 allows the user to self-manage the monitoring rules used by the monitoring platform 314 and the core platform 320. By way of example, these rules can be used to identify events of interest, group related events, suppress events, and identify situations associated with events. Rules defined using the policy manager 334 can be stored in a repository 336, such as a database or other storage and retrieval device or system.

  The fabric monitoring system 110 can further retrieve data from at least one reference data service 338. Reference data service 338 can be used to provide any suitable reference data used by fabric monitoring system 110. For example, the reference data service 338 can be used to obtain information that supports event classification and grouping as well as situation identification. Each data service 338 includes any suitable structure for storing information and facilitating information retrieval.

  Further details of the fabric monitoring system 110 are shown in FIG. As shown in FIG. 4, a user (eg, an application technical owner, etc.) can configure one or more policies, such as by using a self-service portal supported by policy manager 334. Policies can be stored in the repository 336. The policy is made available to the monitoring platform 314, which uses the policy to obtain events from the host 302 and other event sources (among others). Multiple hosts may be running one or more common enterprise applications that are deployed across enterprise systems.

  In this example, the monitoring platform 314 supports a configuration distribution function 402 that provides rules and threshold information from received policies to distributed event agents in hosts and other event sources. Used for. The monitoring platform 314 further supports a state management function 404, which is located between the distributed event agent and the core platform 320, and tracks state transitions to generate events based on the state transitions. A pre-processing component that is sent to the core platform 320. The monitoring platform 314 further supports a suppression function 406, which can be used to suppress a particular event, and thus the event is not used to create a situation. In addition, the monitoring platform 314 supports a “send trap” function that enables an agentless API that is used to send events directly to the core platform 320 from an application or other source. Can be expressed.

  The monitoring platform 314 sends event criteria and monitoring information, such as baseline monitoring policy and application monitoring policy, to the event agent 310 and receives events from the event agent 310. Received events are identified by event agent 310 using event criteria and monitoring information. The monitoring platform 314 may further be able to communicate with the external monitoring module and function 410 and the enterprise scan function 412 and receive events from the external monitoring module and function 410 and the enterprise scan function 412. External monitoring module and function 410 can receive event criteria and monitoring information from monitoring platform 314 and use that information to identify events, while enterprise scan function 412 can operate without such information. it can. As can be seen here, the monitoring platform 314 can receive events from various sources as input. Since the event agent 310, the external monitoring module and function 410, and the enterprise scan function 412 can be distributed across enterprise systems, the monitoring platform 314 receives events that occur in multiple locations and reports the events through the system and Provides visibility into enterprise performance.

  Once the event is received at the monitoring platform 314, the event (or at least an unsuppressed event) is forwarded to the core platform 320, where the event is evaluated according to the rules loaded from the policy. For example, rules can be used to classify events and determine which type of processing model will be used to monitor the stream of events arriving at the core platform 320. Thus, at least one processing model is selected and used to determine when the situation should be created. Events can be marked as suppressed after classification, and the model that evaluates the event either handles the suppressed event ignoring the suppression index, or uses the suppression index to mark the suppressed event. Can be ignored. Correlation and aggregation functions 322 and 324 can be driven by rules and the model specified by the rules during event classification.

  One or more ticketing creation functions 414 are now used within the core platform 320. The identified situations can be distributed to the ticketing creation function 414 based on the rules loaded from the policy, and the rules loaded from the policy indicate which ticketing creation function 414 is appropriate for which situation. Once the event is processed within the core platform 320, the event or situation may be directed to any number of additional destinations 416, such as a terminal, processor, or user, for recording, analysis, corrective / preventive actions, or other functions. Made available for escalation.

  In some embodiments, the core platform 320 provides clustering of related events into service impact situations. Such clustering, in some instances, in surveillance noise by clustering or grouping analytically similar events, excluding duplicate events, and identifying analytically unique events. % Or more reduction is possible.

  Situations, like events, can be further processed to create multiple situation models, such as discovered and / or user-defined models. Due to the ticketing and event / status recording capabilities of the fabric monitoring system 110, a transparent and sufficient audit trail of all events and status can be provided. In addition, event and situation recording, categorization, and auditing provide the ability to analyze and identify trends, outliers, fake situations, and other data associated with the events and situations.

  FIG. 5 shows further details on how events can be handled in certain embodiments of the core platform 320. As shown in FIG. 5, various event sources 502 provide events to the fabric monitoring system 110. Event sources 502 include applications, host servers, and user equipment that can provide events to the fabric monitoring system 110, such as through the use of an event agent 310. Events are reported through event bus 504, which may represent a queue or other structure configured to receive events. The event bus 504 can be used in the monitoring platform 314 or the core platform 320, for example.

  The event processing system 504 includes an event registration module 508, a model evaluation module 510, and a situation enhancement module 512. The event registration module 508 can identify incoming events, assign a unique identifier to the event, and perform other actions associated with the incoming event. The model evaluation module 510 processes the event and identifies various situations associated with the event. The situation enhancement module 512 processes the identified situation and provides further information regarding the identified situation.

  Modules 508-512 pull data and information from event policy store 514, event / status store 516, and key process indicator (KPI) store 518. An audit trail and tracking module 520 and an event / situation viewer 522 or other user interface are further provided. Event policy store 514 represents a storage device in which various user-defined or other policies are stored, for example, when policies are received from repository 336. Event / situation store 516 stores information regarding received events and identified situations. KPI store 518 provides information regarding the measurements captured by fabric monitoring system 110 and how the measurements are used. The audit trail and tracking module 520 tracks information about events and situations, and stores the information, including information about the events and the situation itself and how the situation is resolved. The event / status viewer 522 interfaces with the fabric monitoring system 110 and provides a user interface for viewing the results obtained by the fabric monitoring system 110.

  Event processing system 504 provides grouped and categorized events that define a situation to status bus 524, which may represent a queue or other structure configured to output the situation. . The status is now output to destination 526, eg, to a console, device, and messaging service for user confirmation, and to a server and processor for automated processing.

  The use of the fabric-based monitoring architecture in the system 110 to support the complex event processing shown here moves away from enterprise system failure alerts as seen in previous enterprise monitoring capabilities. Instead, the fabric monitoring system 110 enables event / situation awareness across enterprise systems. In the exemplary embodiment shown here, event classification is based on event processing through the use of a monitoring definition language (such as DSL) and separation or other categorization of the stream of events into the domain for isolation. Includes self-service definitions. A processing module in the fabric monitoring system 110 defines how to process events and create a situation, and how to handle individual events. The model can be defined in any way to best categorize the expected events across the enterprise system. For example, the model may include event frequency, event type, event location or local impact, or event source (eg, external impact on enterprise system, eg hacking, unregistered use, unauthorized use) Or multiple uses by the same user, etc.) to process the event and create a situation. The analytical model can further be used to cluster events into situations with the same root cause, the same geographic location, or the same date / time occurrence.

  In an exemplary embodiment, the fabric monitoring system 110 can generate a signal representing a composite event for a dependent asset based on a pluggable reference data source. For example, an event associated with a host going down can lead to the generation of a composite event for application deployment. Further, in the exemplary embodiment, fabric monitoring system 110 provides sufficient transparency of processing to indicate how and why events are grouped or processed to create one or more situations.

  The use of the fabric monitoring system 110 is sufficiently resilient, and the fabric monitoring system 110 can be scalable in multiple dimensions. For example, the number of computing nodes 112 used in the fabric monitoring system 110 can be adjusted based on the load, and the number of instances of the fabric monitoring system 110 (number of stripes) can also be adjusted based on the load. In some examples, the fabric monitoring system 110 can handle up to 1000 events or more per minute. As a specific example, the fabric monitoring system 110 (on average) receives approximately 2.8 million events per day for a particular facility, processes approximately 1.7 million events (the rest are suppressed), and approximately 130,000. The situation can be identified.

  In some embodiments, the fabric monitoring system 110 can support a pluggable messaging architecture, such as through the use of any JAVA MESSAGE SERVICE (JMS) compliant messaging. The fabric monitoring system 110 can further support event and service enrichment via one or more reference data sources, and embedded event correlation is performed via discovered and modeled analysis methods. Can do. The fabric monitoring system 110 is easily pluggable into an external automation framework, supports event suppression and submission APIs, and can support event policy definitions via self-defined DSLs. The fabric monitoring system 110 provides the ability to build custom situation models, the ability to track events and situations, and can provide an agent-agnostic framework.

  One exemplary use of the monitoring definition language is shown in FIG. Domain-specific languages allow users to self-describe events and how to handle events. This information can be provided to the policy manager 334 and stored in the repository 336 as a policy. As shown in FIG. 6, the user can define multiple event files 602, each of which defines one or more types of events. The user can also combine multiple event files 602 to generate a single processing model file 604, which can be used to identify the occurrence of a situation. This type of functionality can be used by any number of users to define the events of interest and how the events are grouped into situations.

  Use of the monitoring definition language allows a team of personnel to more easily manage the monitoring performed by the fabric monitoring system 110. The use of the monitoring definition language further provides improved transparency regarding how events are being processed and the coverage and usage of the fabric monitoring system 110. Further, the use of a monitoring definition language can provide control over publishing changes and releasing changes for rules.

  In some embodiments, the monitoring definition language defines a package that includes the definition of the event, how the monitoring of the event occurs, and how the situation is identified as a result of the monitoring. Can be used. The following represents one example of a package that can be defined using a monitoring definition language.

ファブリック監視システム１１０内の様々な機能が、様々な恩恵を得ることを可能にする。例えば、ファブリック監視システム１１０をインシデント管理及び自動化プラットフォームと統合し、ポリシーを監視するシステム開発ライフサイクル（ＳＤＬＣ）サポート及び制御を提供することが可能である。さらに、ファブリック監視システム１１０を使用して、ビジネスユニットにわたる生産及び動作状況への可視性を提供し、複数のストライプによりイベントストリームを隔離することが可能である。ストライプは、ファブリック監視システム１１０の別個のインスタンスにより処理される地域又はビジネスユニットに関連付けられたイベントのセットとして定義できる。ストライプは、別個のサービスインスタンスを有するメッセージング、持続、及び処理の、その独自のインスタンスを有することができる。１つのストライプの動作は、他のストライプから独立であり得、クロスストライプ相関のためのストライプ間の通信は、合成イベントを通して発生することができる。

Various functions within the fabric monitoring system 110 allow for various benefits. For example, the fabric monitoring system 110 can be integrated with an incident management and automation platform to provide system development lifecycle (SDLC) support and control for monitoring policies. In addition, the fabric monitoring system 110 can be used to provide visibility into production and operational status across business units and to segregate event streams with multiple stripes. A stripe can be defined as a set of events associated with a region or business unit that is handled by a separate instance of the fabric monitoring system 110. A stripe can have its own instance of messaging, persistence, and processing with separate service instances. The operation of one stripe can be independent of the other stripes, and communication between stripes for cross stripe correlation can occur through synthesis events.

  Note that each of the platforms, functions, and modules described above can be implemented using any suitable hardware or combination of hardware and software / firmware instructions. In certain embodiments, each of the platforms, functions, and modules includes software instructions that are executed by one or more processing devices. Multiple processing devices can execute multiple instances of platforms, functions, and modules, and the processing devices can be distributed across any number of nodes of the fabric computing system.

  Although FIGS. 3-6 illustrate one example of a fabric monitoring system 110 and related details that handle events involving computing systems and networks, various changes may be made to FIGS. 3-6. . For example, the functional division shown in FIGS. 3-6 is merely exemplary. Various components in FIGS. 3-6 may be combined, further subdivided, rearranged, or omitted, and additional components may be added according to particular needs.

  7 and 8 illustrate an exemplary processing flow and related details in a computing system using a fabric monitoring system according to the present disclosure and a system for handling events involving the network. Specifically, FIG. 7 shows an exemplary process flow 700 for handling events and identifying situations, and FIG. 8 shows an exemplary process flow 800 for handling identified situations. Although FIGS. 7 and 8 are described with respect to the fabric monitoring system 110 of FIG. 1 having an implementation as shown in FIGS. 3-6, the process flows 700 and 800 may be used with any suitable fabric monitoring system. Note that it can be used in any suitable system.

  As shown in FIG. 7, at step 702, an event occurs within the enterprise system and is provided to the fabric monitoring system. This may include, for example, the event agent 310 identifying an event in the host 302 or other event source 502 and providing the event to the monitoring platform 314 or event bus 504.

  In step 704, the event is registered. This can include, for example, identifying the incoming event by the monitoring platform 314 or the event registration module 508 of the event processing system 504 and performing various actions using the event. The event registration here occurs using various data. For example, event registration is a rule obtained from one or more fabric monitoring policies, eg, to match an event to a domain of interest and individual events to a specific event type (predefined type or derived) Based on self-service rules etc. to match). Reference data can further provide rule queries or other event categorization to assist in event registration. During event registration, events can be matched against patterns and values specified in policies. After an event is matched using a rule, the event can be checked to see if it matches any suppression criteria loaded from the policy system. If the event matches, the event can be annotated as being within the suppression interval, so one or more processing models can take that into account. During event registration, events can be assigned an asset name, event name, processing model type, and event unique identifier (UID) (if not pre-assigned).

  Events are dispatched at step 706 and evaluated at step 708. This may include, for example, the core platform 320 or the model evaluation module 510 of the event processing system 504 evaluating the event to identify if any situation is indicated by the event. The core platform 320 or model evaluation module 510 can receive various inputs and process the event stream, eg, multiple inputs for each asset name, to create a situation. Inputs to the core platform 320 or model evaluation module 510 may include fabric policy rules and other model information, model and status state information, and enterprise reference data. The core platform 320 or model evaluation module 510 processes the event as the latest in the stream of events that potentially form the situation. In some embodiments, the creation of a situation can itself define an event.

  In step 710, any identified status is output. This can include, for example, the core platform 320 or the model evaluation module 510 of the event processing system 504 outputting the identified situation and any associated information.

  As shown in FIG. 8, once a situation is identified from a stream of events according to an applicable fabric policy, the situation is output and enters a status bus distribution service at step 802. A situation can be dispatched from the service bus 524 to various devices or systems, such as various event / situation ticketing systems, depending on the situation. For example, if an automated resolution of the situation is possible or permitted, the situation can be dispatched to the automation agent at step 804. An automation agent can represent an application or other logic that performs some one or more functions to automatically resolve a given situation. If an automated resolution of the situation is not possible or allowed, and the particular ticketing system is identified or associated with the situation, the situation can be dispatched to the ticketing and incident agent at step 806. The ticketing and incident agent can then generate a ticket or other notification according to the specifications of the ticketing and incident system. Ticketing and incident agents can return a reference identifier for the situation and an indication that the situation should be closed.

  If no ticketing and incident agent is identified, the situation can be provided to the lightweight ticketing agent in step 808. The lightweight ticketing agent includes a ticket persistence database that supports status storage in step 810 and receives input from one or more execution services. Lightweight ticketing agents convert tickets into alerts, act as a bridge for live intervention and generate emails, message notifications, or other notifications to relevant users or stakeholders . In this example, the lightweight ticketing agent can provide one or more messaging topics (such as alerts) to an alert caching service at step 812, which alerts at least one to one or more users at step 814. Alerts can be notified via the console. Using the console, the user can identify various alert actions to be performed for each alert, such as assigning or closing the alert. An alert action is provided to one or more execution services in step 816, which may perform steps for performing the selected alert action. For example, an execution service may issue an “event processing fabric” (EPF) action to be performed by a lightweight ticketing agent at step 818 and / or by another fabric computing core at step 820.

  7 and 8 show examples of processing flows 700 and 800 and associated details in a system that handles events involving computing systems and networks using a fabric monitoring system, although various changes may be made to FIGS. May be performed. For example, the various steps in each figure may overlap, occur in parallel, occur in different orders, or occur any number of times. Further, the process flow shown here may vary depending on how the event is identified and converted to a situation and how the situation is handled within a particular fabric monitoring system.

  The use of the fabric monitoring system 110 described above for monitoring, diagnosing, and maintaining a computing system or network 102a-102n provides a technical solution to technical problems in the field of computer and network management. As described above, the events handled by the fabric monitoring system 110 are the current state of the device, system, or network in the computing system or network 102a-102n or a change in the current state and an abnormal or defined condition. Can be related to the occurrence of For large enterprise systems, the number of events is large and can sometimes reach several thousand per minute. This makes it very difficult for personnel to manually review and resolve events and identify related events that may indicate a more serious security breach or other problem within the computing system or network 102a-102n, or Make impossible.

  The fabric monitoring system 110 supports automated identification of events, as well as automated classification of events and status identification from related events. This makes it much easier to manage events, identify situations to be resolved, and possibly even resolve them automatically. Among other things, this may help to keep the computing system or networks 102a-102n functioning more smoothly and solve the problems that arise. Furthermore, as mentioned above, this defines in a customizable way, for example, events, how event monitoring occurs and how events are used to identify situations. It can be done by doing. This provides great flexibility in the use of the fabric monitoring system 110. Other technical features are further provided above.

  In some embodiments, the various functions described in this patent document are implemented or supported by a computer program formed from computer readable program code and embodied in a computer readable medium. The phrase “computer readable program code” includes any type of computer code including source code, object code, and executable code. The phrase “computer readable medium” includes any type of medium accessible by a computer, such as read only memory (ROM), random access memory (RAM), hard disk drive, compact disk (CD), digital video disk (DVD). Or any other type of memory. “Non-transitory” computer-readable media excludes wired, wireless, optical, or other communication links that carry temporary electrical or other signals. Non-transitory computer readable media include media that can store data permanently, and media that can store data and can be overwritten later, such as a rewritable optical disk or an erasable memory device.

  It may be advantageous to specify the definitions of specific words and phrases used throughout this patent document. The terms “application” and “program” refer to one or more computer programs, software components, instruction sets, procedures adapted for implementation in appropriate computer code (including source code, object code, or executable code). , Function, object, class, instance, related data, or part thereof. The term “communicate” and its derivatives encompass both direct communication and indirect communication. The terms “include” and “include”, and derivatives thereof, mean including without limitation. The term “or” is inclusive, meaning and / or. The phrase “associated with” and its derivatives include, includes, includes, interconnects with, includes, includes in, connects to, connects to, or binds to. , Can communicate with, cooperate with, interleave, juxtapose with, have proximity to, have, have, have, have, or have a relationship to, or similar Can mean things. When the phrase “at least one of” is used with a list of items, different combinations of one or more of the listed items may be used and only one item in the list may be required. Means that. For example, “at least one of A, B, and C:” includes any of the following combinations: A, B, C, A and B, A and C, B and C, and A and B And C.

  The description in this patent document should not be read as implying that any particular element, step, or function is an essential or critical element to be included in the claims. Further, unless the exact word “means for” or “step for” is explicitly used within a particular claim and is followed by a participle phrase that identifies the function, any claim shall be It is not intended to enforce 35 USC 112 (f) 35 USC 112 (f) with respect to any of the claim elements. Within the claims, (but not limited to) “mechanism”, “module”, “device”, “unit”, “component”, “element”, “member”, “device”, “machine”, “ The use of terms such as “system”, “processor”, “processing device”, or “controller” is understood and referenced to refer to structures known to those skilled in the art as further modified or enhanced by the features of the claims themselves. It is intended and not intended to enforce 35 USC 112 (f).

While this disclosure has described particular embodiments and generally associated methods, modifications and permutations of these embodiments and methods will be apparent to those skilled in the art. Accordingly, the above description of example embodiments does not define or constrain this disclosure. Other changes, substitutions, and modifications are further possible without departing from the spirit and scope of this disclosure, as defined by the following claims.

Claims (22)

In a fabric monitoring system, receiving information identifying the occurrence of an event in an enterprise system that includes a plurality of computing or networking systems, the event being transmitted to a computing or networking device in the computing or networking system Occurs or participates, and the event is identified using rules accessible by the fabric monitoring system;
Using the fabric monitoring system to process the information in real time to identify the occurrence of the event and assign the event to a plurality of situations, the event being one accessible by the fabric monitoring system; Steps assigned to the situation using the above processing model;
Outputting information identifying the situation;
Including methods.   The fabric monitoring system is scalable in multiple dimensions, one dimension being associated with the number of computing nodes operating within the fabric monitoring system, another dimension being associated with the number of stripes, each stripe being the fabric The method of claim 1, comprising a portion of a monitoring system or a separate instance of the fabric monitoring system. Storing information associated with the event and situation, including information about the event and situation and information about how the situation is resolved, and providing an audit trail of the event and situation The method of claim 1. The method of claim 1, further comprising: obtaining the rules from one or more policies, wherein at least a portion of the one or more policies are defined by at least one user using a monitoring definition language. The method described. The one or more processing models define a method for categorizing the event and identifying the situation, wherein the one or more processing models include:
At least one user-defined model defined by at least one user; and
The method of claim 1, comprising at least one analytical model that defines one or more analytical functions that operate using the information identifying the occurrence of the event. The information identifying the occurrence of the event is processed using a plurality of stripes, each stripe comprising a portion of the fabric monitoring system or a separate instance of the fabric monitoring system;
Sending a composite event between the stripes to support cross-stripe correlation of the event or situation;
The method of claim 1 further comprising: Different stripes
Different assets within the computing or networking system,
Different locations where the computing or networking system is deployed,
Different deployments of hardware, software, or firmware within the computing or networking system,
7. Process events associated with at least one of different business units using the computing or networking system and different types of businesses traded using the computing or networking system. Method. The event is
The current state of the computing or networking device within the computing or networking system;
A change in the current state of the computing or networking device within the computing or networking system;
An anomaly in the computing or networking device within the computing or networking system; and
The method of claim 1, comprising at least one of occurrence of a defined condition in the computing or networking system. Outputting the information identifying the situation comprises:
The method of claim 1, comprising providing information identifying at least one of the situations to an automated agent that automatically resolves the at least one situation. Obtaining the information identifying the situation comprises:
Providing information identifying at least one of the situations to a ticketing agent that generates at least one notice for personnel, wherein the at least one notice identifies the at least one situation. The method of claim 1 comprising: A system,
A fabric monitoring system comprising a plurality of computing nodes and a plurality of communication links coupling the computing nodes, the fabric monitoring system comprising:
Receiving information identifying the occurrence of an event in an enterprise system including a plurality of computing or networking systems, wherein the event occurs or is involved in a computing or networking device in the computing or networking system The event is identified using rules accessible by the fabric monitoring system;
Processing the information in real time to identify the occurrence of the event and assigning the event to a plurality of situations, the event using the one or more processing models accessible by the fabric monitoring system; Assigned to the situation,
A system configured to output information identifying the situation.   The fabric monitoring system is scalable in multiple dimensions, one dimension being associated with the number of computing nodes operating in the fabric monitoring system, another dimension being associated with the number of stripes, and each stripe being The system of claim 11, comprising a portion of a fabric monitoring system or a separate instance of the fabric monitoring system.   The fabric monitoring system stores information associated with the event and situation, including information about the event and situation and information about how the situation is resolved, and provides an audit trail of the event and situation. The system of claim 11, further configured to provide.   A repository configured to store one or more policies including the rules, wherein at least a portion of the one or more policies are defined by at least one user using a monitoring definition language. Item 12. The system according to Item 11. The one or more processing models define a method for categorizing the event and identifying the situation, wherein the one or more processing models include:
At least one user-defined model defined by at least one user; and
The system of claim 11, comprising at least one analysis model that defines one or more analysis functions that operate using the information identifying the occurrence of the event. The system includes a plurality of stripes, each stripe including a portion of the fabric monitoring system or a separate instance of the fabric monitoring system;
Each stripe is configured to process at least a portion of the information identifying the occurrence of the event;
Each stripe is configured to generate and send a composite event to other stripes to support cross-stripe correlation of the event or situation.
The system of claim 11.   The system of claim 16, wherein each stripe is configured to generate at least some of the composite events for identifying a situation by the stripe. Different stripes
Different assets within the computing or networking system,
Different locations where the computing or networking system is deployed,
Different deployments of hardware, software, or firmware within the computing or networking system,
Claims configured to process events associated with at least one of different business units using the computing or networking system and different types of businesses traded using the computing or networking system. Item 17. The system according to Item 16. The event is
The current state of the computing or networking device within the computing or networking system;
A change in the current state of the computing or networking device within the computing or networking system;
An anomaly in the computing or networking device within the computing or networking system; and
The system of claim 11, comprising at least one of occurrence of a defined condition in the computing or networking system.   The fabric monitoring system outputs the information identifying the situation by providing information identifying at least one of the situations to an automated agent that automatically resolves the at least one situation The system of claim 11, configured as follows.   The fabric monitoring system outputs information identifying the situation by providing information identifying at least one of the situations to a ticketing agent that generates at least one notification for personnel. The system of claim 11, wherein the system is configured and the at least one notification identifies the at least one situation. A non-transitory computer readable medium containing computer readable program code, the computer readable program code being executed by a computing node of a fabric monitoring system,
Receiving information identifying the occurrence of an event in an enterprise system including a plurality of computing or networking systems, wherein the event occurs or is involved in a computing or networking device in the computing or networking system The event is identified using rules accessible by the fabric monitoring system;
Processing the information in real time to identify the occurrence of the event and assigning the event to a plurality of situations, the event using the one or more processing models accessible by the fabric monitoring system; Assigned to the situation,
Outputting information identifying the situation;
A non-transitory computer-readable medium.

Images